## Tekton task steps run as root without defense-in-depth securityContext hardening

**Component:** konflux-operator-tasks

Tekton task steps run as root (including steps that don't require it, such as `oras` steps) without defense-in-depth securityContext hardening such as dropped capabilities, `allowPrivilegeEscalation: false`, or a restrictive seccomp profile.

### Remediation
Where root/SETFCAP is genuinely required, add `capabilities.drop: [ALL]` alongside `add: [SETFCAP]`, set `allowPrivilegeEscalation: false`, `seccompProfile.type: RuntimeDefault`, and `readOnlyRootFilesystem: true` with explicit emptyDir mounts for scratch paths. Where root is not required (oras steps), drop `runAsUser: 0`.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-004*